CVE-2019-25530
Published: 12 March 2026
Description
uHotelBooking System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the system_page GET parameter. Attackers can send crafted requests to index.php with malicious system_page values using time-based blind SQL injection…
more
techniques to extract sensitive database information.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection in the system_page GET parameter by requiring validation of all information inputs before use in database queries.
Requires timely remediation of the specific SQL injection flaw in uHotelBooking's index.php through identification, reporting, and correction.
Restricts malicious inputs to the system_page parameter by limiting to organization-defined safe values, blocking SQL injection payloads.
Security SummaryAI
CVE-2019-25530 is an SQL injection vulnerability (CWE-89) in the uHotelBooking System, published on 2026-03-12. The flaw resides in the system_page GET parameter within index.php, where attackers can inject SQL code to manipulate database queries. It enables time-based blind SQL injection techniques through crafted requests, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. By sending specially crafted HTTP GET requests to index.php with malicious values in the system_page parameter, they can extract sensitive database information, achieving high confidentiality impact alongside low integrity impact and no availability disruption.
Advisories and exploit details are documented in references including Exploit-DB (https://www.exploit-db.com/exploits/46587) and a Vulncheck advisory (https://www.vulncheck.com/advisories/uhotelbooking-system-lastest-sql-injection-via-system-page-parameter), which cover the SQL injection via the system_page parameter.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2019-25530 is an unauthenticated SQL injection in a public-facing web application (uHotelBooking index.php), directly enabling T1190 (Exploit Public-Facing Application). It facilitates blind SQLi for extracting sensitive database information, mapping to T1213.006 (Data from Information Repositories: Databases).